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A METHOD OF PROCESSING DIGITAL MATERIAL 



BACKGROLTND AND FIELD OF THE INVENTION 



5 



This invention relates to a method of processing digital material, more particular!}* but 
not exclusively to a process which allows the generation and distribution of customized 
digital material. 

10 The recent exponential growth of Internet usage has provided a corresponding 
opportunity for selling digital goods through this medium. Such digital goods include 
application programs, images, videos, audio files and other digitized IPR (Intellectual 
property rights) material. However, due to security issues, large IPR ow-ners are 
hesitant to embrace the Internet for selling their products. The ease by which software 

15 may be duplicated, together with the access to such goods in digital form that 
transmission over the Internet requires and which sale of legitimate digital goods would 
initially provide, makes the subsequent distribution of counterfeit digital goods much 
easier. 

20 This problem has given rise to active research in the field of digital watermarking. 
Such technology embeds licence and owner information into the digital goods which 
can help to trace the source of counterfeit goods in the event that duplicated copies of 
some digital IPR materials are found. Another method is to include access control 
information within the digital goods to restrict its usage. One particular problem with 
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such tecliniques is that the licence information needs somehow to be applied to the 
digital goods in a cost-effective and secure way. If the information is embedded in the 
program code of the digital goods, this will require the program to be recompiled every 
time, so that the new licence and owner information can be included in the machine 
5 code, which may be prohibitively costly. Alternatively, if the information is embedded 
in the data of the digital goods, the information may be vulnerable, since the program 
code that is used to access the data can be rewritten to ignore that part of the data and 
thus bypass the access control information. 

10 It is an object of the invention to provide a novel method of processing digital material 
which allows such information to be incorporated into digital goods. 

SUMMARY OF THE INVENTION 

1 5 According to the invention in a first aspect there is provided a representation of digital 
material, the digital material comprising program code and data and the representation 
comprising a combination of the code, data and an execution state existing at a 
predetermined execution point when the program code is run, customization 
information being provided during running of the program code prior to the execution 

20 point being reached so that said representation is customized by said customization 
information. 



According to the invention in a second aspect, there is provided a method of 
processing digital material, the material comprising program code and data, the method 
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comprising the steps of: (1) running the program code until a predetermined execution 
point is reached, an execution state existing at tiie execution point; and (2) forming a 
combined representation of the execution state, data and program code at that execution 
point, the data, code and execution state being restorable from said representation so 
that execution of the material may subsequently be resumed from the execution point. 

Further features of the invention are recited in the claims appendant hereto. 

The term "execution state" means the values and contents of transient parameters such 
as the contents of registers, context frames, counters and the like. 

In the described embodiment of the invention, a method is disclosed that provides a 
flexible mechanism to prevent the possibility of digital material transmitted over a 
communication network, in particular digital goods to be marketed, from being 
duplicated. Using such a method, any type of digital material can be transmitted by 
hiding the information as part of a single representation termed a computing process 
in which data, program code and execution state are combined. Such computing 
processes can be structured by the IPR providers to include necessary anti-copying 
mechanisms and standard security protection like channel privacy, user and machine 
authentication, etc. Since the computing processes could be made unique to each IPR 
provider and changed frequently independent of the information included in them, it 
could render any duplication effort very difficult and costly. 



Specific examples of applications of this method disclosed are the protection of video. 
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audio and other multimedia material supplied over the hiternet or electronically. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Some embodiments of the present invention will nov^ be described by way of 
example and with reference to the accompanying drawings, in which: 

Fig.l is a general schematic model of an operating environment of a computing 
system ; 

Fig.2 schematically illustrates a process life-cycle and operations that may be 
performed on a process, 

Fig.3 is a flow-chart illustrating the operation Hibernaculum Construct(Stack 
s. Module m, Data d), 

Fig.4 is a flow-chart illustrating operation int Assiniilate(Hibemaculum h, 
Override Flags f), 

Fig.5 is a flow-chart illustrating the operation int Usurp(Hibemaculum h, 
Override Flags f)» 

Fig.6 is a flow-chart illustrating the operation int Bequeaih(Hibernaculum h. 
Thread tlireadname, OveiTide Flags f), 

Fig.7 is a flow-chait illustrating the operation int lnherit(Hibernaculum h. 
Thread threadname, Override Flags f)> 

Fig.8 is a flow-chart illustrating the operation int Mutate( Stacks, int sFlag, 
Module m, int mFlag, Data d, int dFlag), 

Fig.9 is a flow-chart illustrating the operation int Checkpoint(Process pi , Target 
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Fig. 10 is a flow-chart illustrating the operation int Migrate(Process pK Machine 



Fig. 1 1 is a schematic diagram of a specific embodiment of the invention for 
the sale of videos on-line, 

Fig. 12 is a view of a login screen of the embodiment of Fig. 11, 

Fig. 13 is a view of a video selection screen of the embodiment of Fig. 1 1, and 

Fig. 14 is a view of a download screen of the embodiment of Fig. 11. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 

The embodiments of the invention to be described rely on a representation of digital 
material being generated, termed a process, which comprises a combination of data, 
program code and execution state. This general technique will now first described, 
following which, embodiments of the invention, being specific applications of the 
teclinique will be described. 

Figure 1 shows the general model of a computing system. An application program 30 
comprises data 10 and program modules 20, The operating system 60, also known as 
the virtual machine, executes the application 30 by carrying out the instructions in the 
program modules 20, which might cause the data 10 to be changed. The execution is 
effected by controlling the hardware of the underlying machine 70. The status of the 
execution, together with the data and results that the operating system 60 maintains for 
the application 30, form its execution state 40. 
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Such a model is general to any computing system. It should be noted here that the 
present invention staits from the realisation that all the information pertaining to the 
application at any lime is completely captured by the data 10, program modules 20 and 
execution state 40, known collectively as the process 50 of the application 30. 

The process 50 can have one or more threads of execution at the same time. Each 
thread executes the code of a single program module at any given time. Associated 
with the thread is a current context frame, which includes the following components: 

1. A set of registers; 

2. A program counter, which contains the address of the next instruction to be 
executed; 

3. Local variables of the module; 

4. Input and output parameters of the module; 

5. Temporary results of the module. 

In any module A, the thread could encounter an instruction to invoke another module 
B. In response, the program counter in the current frame is incremented, then a new 
context frame is created for the thread before it switches to executing module B. Upon 
completing module B, the new context frame is discarded. Following that, the thread 
reverts to the previous frame, and resumes execution of the original module A at the 
instruction indicated by the program counter, i.e., the instruction immediately after the 
module invocation. Since module B could invoke another module, which in turn could 
invoke some other module and so on, the number of frames belonging to a thread may 
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grow and reduce with module invocations and completions. However, the current frame 
of a tliread at any given time is always the one that was created last. For this reason, 
the context frames of a thread are typically stored in a stack with new frames being 
pushed on and popped from the top. The context frames of a thread form its execution 
5 state, and the state of all the threads within the process 50 constitute its execution state 
40 in Fig.l. 

The data 10 and program modules 20 are shared among all threads. Tlie data area is 
preferably implemented as a heap, though this is not essential. The locations of the 
data 10 and program modules 20 are summarized in a symbol table. Each entry in the 
10 table gives the name of a datum or a program module, its starting location in the 
address space, its size, and possibly other descriptors. Instead of having a single 
symbol table, each process may alternatively maintain two symbol tables, one for data 
alone and the other for program modules only, or the process could maintain no 
symbol table at all. 

15 

In a preferred embodiment of the present invention, the data and program code of a 
process are stored in a heap and a program area respectively and are shared by all the 
threads within the process. In addition the execution state of the process comprises a 
stack for each thread, each stack holding context frames, in turn each frame containing 
20 the registers, local variables and temporary results of a program module, as well as 
addresses for further module invocations and returns. Before describing an embodiment 
of the invention in more detail, however, it is first necessary to introduce some 
definitions of data types and functions that are used in the embodiment and which will 
be referred to further below. 
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In addition to conventional data types such as integers and pointer, four new data ly 
Data, Module, Stack and Hibernaculum are defined in the present invention: 



Data: A variable of this data type holds a set of data references. Members are added 
to and removed from the set by means of the following functions; 

Int AddDatum(Data d, String dataname) inserts the data item dataname in the 
heap of the process as a member of d. 



Int DelDatum(Data d. String dataname) removes the data item datanfmm d 

Module: A variable of this data type holds a set of references to program modules. 
Members are added to and removed from the set with the following functions; 

Int AddModule(ModuIe d. String modulename) inserts the program module 
modulename in the program area of the process as a member of d. 

Int DelModule(Module d, Stringname modulename) removes the program 
module modulename from d. 



Stack: A variable of this data type holds a list of ranges of execution frames 

from the stack of the threads. The list may contain frame ranges from multiple threads, 
however no thread can have more than one range. Variables of this type are 
manipulated by the following functions: 
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Int OpenFraiTie(Stack d, Thread threadname) inserts into d a new range for the 
thread tlueadname, beginning with the thread s current execution frame. This function 
has no effect if the thread already has a range in d. 

5 Int CloseFrame(Stack d, Thread threadname) ends the open-ended range in d 

that belongs to the thread threadname. This function has no effect if the thread does 
not currently have an open-ended range in d. 

Int PopRange(Stack d, Thread tlireadname) removes from d the range belonging 
10 to the thread threadname. 

Hibernaculum: A variable of this data type is used to hold a suspended process. 

As will be explained in more detail below a process may be suspended and 
15 stored in a construct prior to being transferred from one operating envirormient to 
another operating environment and/or may be subject to evolutionary operations: 

Hibernaculum Construct(Slack s. Module m, Data d): This operation creates a new 
process with the execution state, program table and data heap specified as input 
20 parameters. The process is immediately suspended and then returned in a 
hibernaculum. The hibernaculum may be signed by the originating process as 
indication of its authenticity. Fig. 3 is a flow-chart showing the hibernaculum construct 
operation. 
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A hibernaculum may be sent between operating environments by the following 
send and receive functions: 

Int Send(Hibernaculum h, Target t) transmits the process contained within h to the 
specified target. 

Hibernaculum Receive(Source s) receives from the specified source a hibernaculum 
containing a process. 

A hibernaculum may be subject to the following evolutionary functions: 

Int Assimilate(Hibernaculum h, OverrideFIags f) activates the threads of the process 
stored within h and runs them as tlireads within a calling process s operating 
environment. Where there is a conflict between the data and/or program modules of 
the hibernaculum and the operating environment, the override flags specify which to 
preserve. Fig.4 is a flow-chart illustrating the steps of the assimilate operation. 

Int Usurp(Hibernaculum h, OverrideFIags f) copies the data and program modules of 
the process within h into the calling process s operating environment. Where there is 
a conflict between the data and/or program modules of the hibernaculum and the 
operating environment, the override flags specify which to preserve. Fig. 5 is a 
flow-chart illustrating the steps of the usurp operation. 



Int Bequeath(Hibemaculum h, Tliread tlireadname, OverrideFIags 0- upon threadname 
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s termination, activates the tlireads of the process stored within h and runs them as 
threads within the environment of the process containing threadname. Where there is 
a conflict between the data and/or program modules of the hibernaculum and the 
calling process, the override flags specify which is to be preserved. Fig. 6 is a 
5 flow-chart illustrating the steps of the bequeath operation. 

Int Inherit(Hibernaculum h, Tliread threadname, OverrideFlags f) suspends threadname 
and activates the process within h. When the process within h terminates its data and 
program modules are added to the process containing tlireadnanie before threadname 
10 is reactivated. Where there is a conflict between the data and/or program modules of 
the hibernaculum and the process containing threadname, the override flags specify 
which is to be preserved. Fig.7 is a flow-chart illustrating the steps of the inherit 
operation. 

15 Int Mutate(Stack s, int sFlag, Module m, int mflag. Data d, int dflag) modifies the 
execution state, program table and data heap of the calling process. If a thread has an 
entry in s, only the range of execution frames specified by this entry is preserved, the 
other frames are discarded. Execution stacks belonging to threads without an entry in 
s are left untouched. In addition, program modules listed in m and data items listed in 

20 d are kept or discarded depending on the flag status. Fig. 8 is a flow-chart illustrating 
the steps of the mutate operation. 

Int Checkpoint(Process p, Target t) creates a snapshot of p including all of its data, 
program modules and execution state. The snapshot is then sent to the specified target. 
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Int Migrate(Process p, Machine m) transfers the process p to the specified machine for 
p to continue execution there. Al of the data (including file iiandles and established 
sockets), program modules and execution state are preser\ed in ilie transfer. 

The typical life cycle of a process is depicted in Figure 2. First, an application 210 or 
a suspended process 220 stored in a hibernaculum is loaded by the operating system, 
then starts running as a process 230. The application 210 may be a program that is 
designed to perform some tasks, or it may be a simple loader that is used to start up 
other processes, while the suspended process 220 could be either produced locally 
earlier or generated on and transferred from another machine. As the process 230 goes 
through the application program logic, the process may create new processes, absorb 
other processes, mutate, or migrate as explained below. 

In particular, the process may be stored in a construct hibernaculum in a suspended 
state. In this condition the process may be subject to a number of operations. To begin 
with the hibernaculum may be sent to another operating environment. Alternatively the 
process may be modified within its own operating environment by the selective 
deletion of elements from within the process, or by the selective reloading of elements 
into the process. A still further possibility is that the process may receive a suspended 
process from another operating environment, and either all or pan of this suspended 
process may be incorporated into the first process. Alternatively all or part of the first 
process may be incorporated into the second process. It will also be understood that 
all these operations may be combined in many different ways. For example, a process 
may be sent from one operating environment to another and then may mutate by 
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dropping cenain elements and reloading other elements when in the second 
enx ironment. In the following description the construction of a hibernaculum, send and 
receive functions, and exemplary evolutionary operations will all be described in 
greater detail. 



New processes are created with the Construct 110 operation. Fig.3 is a flow-chart 
shoeing the steps of this Construct operation. Each invocation of this operation starts 
up a controller thread in the process 230. The controller thread freezes all other active 
tlireads in the process 230, then creates a new process with some or all of the 
execution state, program modules and/or data of the process 230 except for those 
belonging to the controller thread, before resuming the frozen threads. Therefore, the 
new process contains no trace of the controller thread. The new process is suspended 
immediately and returned in a hibernaculum in the data area of the process 230. As 
explained earlier, a hibernaculum is a special data type that serves the sole purpose of 
providing a container for a suspended process. Since a process may have several 
hibemacula in its data area, it could create a new hibernaculum that contains those 
hibemacula, each of which in turn could contain more hibemacula, and so on. When 
the new process is activated subsequently, only those threads that were active just 
before the Construct 110 operation will begin to execute initially: threads that were 
suspended at that time will remain suspended. At the end of the Construct 110 
operation, the controller thread resumes those threads that were frozen by it before 
terminating itself 



specify what execution state should go into the new process, the Construct 1 10 
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operation is passed a list of ranges of context frames. The list may include frames from 
the state of several threads. No thread is allowed to have more than one range in this 
list. A iliread can specify that all of its frames at the time of the Construct 110 
operation are to be included in the list, by calling the AllFrame function beforehand. 
Alternatively, the thread can call the OpenFrame function to register its current frame, 
so that all the frames from the registered frame to the current frame at the time of the 
Construct 110 operation are included in the list. The thread can also call the 
CIoseFrame function subsequently, to indicate that only frames from that registered 
with OpenFrame to the current frame at the time of calling CIoseFrame are to the 
included in the list for the Construct 110 operation. An AllFrame or OpenFrame 
request for a thread erases any previous AllFrame, OpenFrame and CIoseFrame 
requests for that thread. A CIoseFrame request overrides any earlier CIoseFrame 
request for the same tliread, but the request is invalid if the tliread has not already had 
an OpenFrame request. A thread can also make AllFrame, OpenFrame and/or 
CIoseFrame requests on behalf of another thread by providing the identity of that 
thread in the requests; the effect is as if that thread is making those requests itself 

The Construct 1 10 operation can also be passed a list of program modules that should 
go into the newly created process. A thread can specify that all modules of the process 
230 are to be included in the list, by calling the AllModules function prior to the 
Construct 1 10 operation. Alternatively, the thread can call the AddModule function to 
add a specific module to the list, and the DelModule function to remove a specific 
module from the list. The effect of the AllModules, AddModule and DelModule 
requests, possibly made by different threads, are cumulative. Hence a DelModule 
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request after an AUModules request would leave every module in the list except for 
the one removed explicitly, and a DelModule can be negated with an AddModule or 
AUModules request. As there could be multiple AddModule requests for the same 
module and AUModules could be called multiple times, a program module may be 
referenced several times in the list. However, the Construct 1 10 operation consolidates 
the entries in the list, so no program module gets duplicated in the new process. 

To copy some or all of the data of the process 230 to the new process, the Construct 
110 operation can be passed a data list. This list contains only the name of, or 
reference to data that should be copied. The actual data content or values that get 
copied to the new process are taken at the time of the Construct 110 operation, not at 
the time that each datum is added to the list. To ensure consistency among data that 
could be related to each other, all the threads in the process 230 are frozen during the 
Construct 1 10 operation. A thread can specify that all data of the process 230 are to 
be included in the list, by calling the AlIData function prior to the Construct 110 
operation. Alternatively, the thread can call the AddDatum function to add a specific 
datum to the list, and the DelDatum function to remove a specific datum from the list. 
The effect of the AlIData, AddDatum and DelDatum requests, possibly made by 
different threads, are cumulative. Hence a DelDatum request after an AlIData request 
would leave all of the data in the list except for the one removed explicitly, and a 
DelDatum can be negated with an AddDatum or AlIData request. As there could be 
multiple AddDatum requests for the same datum and AlIData could be called multiple 
times, a datum may be referenced several times in the list. However, the Construct 110 
operation consolidates the entries in the list, so no datum gets duplicated in the new 
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Since the lists passed to the Construct 1 10 operation are constructed from the execution 
state, program modules and data of the process 230, the new process initially does not 
contain any component that is not found in the process 230. Consequently, the symbol 
table in the new process is a subset of the symbol table of the process 230. Threads 
in the process 230 that do not have any frame in the new process are effectively 
dropped from it. For those threads that have frames in the new process, when activated 
later, each will begin execution at the instruction indicated by the program counter in 
the most recent frame amongst its frames that are copied. By excluding one or more 
of the most recent frames from the new process, the associated thread can be forced 
to return from the most recent module invocations. An exception is raised to alert the 
thread that those modules are not completed nonnally. Alternatively, the thread can be 
made to redo those modules upon activation, by decrementing the program counter in 
the most recent frame amongst those frames belonging to that thread that are copied. 
Similarly, by excluding one or more of its oldest frames from the new process, a 
thread can be forced to terminate directly after completing the frames that are included. 

Hibemacula, produced by the Construct 110 operation, can be exchanged between 
processes via the Send 120 and Receive 130 operations. The process 230 can send a 
hibemaculum in its data area out on an output stream, by invoking the Send 120 
operation with the hibernaculum and output stream as parameters. Tlie output stream 
could lead to either a disk file, a memory stream, a device stream, or the input stream 
of another process, possibly on a different machine. In the former case, the process in 
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the hibernaculum is stored away for the time being, whereas in the latter case the 
process in the hibernaculum is received directly into the data area of another process. 

The process 230 can also acquire other processes via the Receive 130 operation, w hich 
receives from an input stream a hibernaculum containing a suspended process. The 
source of the input stream could be a disk file, a memory stream, a device stream, or 
the output stream of another process, possibly from a different machine. 

The process 230 can absorb the suspended process within a hibernaculum through the 
Assimilate 140, Usurp 150, Bequeath 160 and Inherit 170 operations. These operations 
can be invoked by any thread in the process 230, or by another process that has 
appropriate permissions. The hibernaculum could have been created by the process 230 
itself earlier, or received from another process via a disk file or an input stream. 

The Assimilate 140 operation accepts a hibernaculum as input. Fig.4 is a flow-chart 
showing this operation in detail. The operation starts up a controller tliread in the 
process 230. The controller thread freezes all other active threads in the process 230, 
adds the program modules and data of the process in the hibernaculum to the program 
modules and data of the process 230, respectively, and updates its symbol table 
accordingly. In case of a name conflict, the program module or data from the 
hibernaculum is discarded in favor of the one from the process 230 by default. 
However, a flag can be supplied to give preference to the hibernaculum. Moreover, the 
context frames of the threads within the hibernaculum are added to the execution state 
of the process 230, enabling those threads to run within the process. Only those threads 
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that were active just before the hibernaculum was created are activated initially; threads 
that were suspended at that time remain suspended. Each newly acquired thread begins 
execution at the instruction indicated by the program counter in tlie most recent frame 
amongst the context frames that belong to that thread. Finally, all the original threads 
in the process 230 that were frozen by the controller thread are resumed before it 
terminates itself. 

The Usurp 150 operation, which also accepts a hibernaculum as input, enables the 
process 230 to take in only program modules and data from a hibernaculum, without 
acquiring its tlireads. Fig.5 is a flow-chart showing this operation in detail. The 
operation starts up a controller thread in the process 230. The controller thread freezes 
all other active threads in the process 230, adds the program modules and data of the 
process in the hibernaculum to the program modules and data of the process 230, 
respectively, and updates its symbol table accordingly, hi case of a name conflict, the 
program module or data from the hibernaculum is discarded in favor of the one from 
the process 230 by default. However, a flag can be supplied to give preference to the 
hibernaculum. Finally, all the original threads in the process 230 that were frozen by 
the controller thread are resumed before it terminates itself. 

The Bequeath 160 operation accepts a hibernaculum and a thread reference as input. 
Fig.6 is a flow-chart showing this operation in detail. It stans up a bequeath-thread in 
the process 230. The bequeath-thread registers the referenced thread and any existing 
bequeath-threads on that thread, then allows them to carry on execution without 
change. After all those threads and threads that they in turn activate have terminated. 
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the bequeath-thiead loads in the context frames, program modules and data in the 
hibernaculum. In case of a name conflict, the program module or data from the 
hibernaculum is discarded in favor of the one from the process 230 by default. 
However, a flag can be supplied to give preference to the hibernaculum. Subsequently, 
threads within the hibernaculum are activated to run in the process 230 before the 
bequeath-thread terminates itself. Only those threads that were active just before the 
hibernaculum was created are activated initially; threads that were suspended at that 
time remain suspended. Each newly acquired thread begins execution at the instruction 
indicated by the program counter in the most recent frame amongst the context frames 
that belong to that thread. If multiple Bequeath 160 requests are issued for the same 
lliread, there will be several bequeath-threads in the process 230. Each bequeath-thread 
will wait for all the existing bequeath-threads on the same tliread, together with all the 
threads that they activate, to terminate before performing its function. As a result, the 
Bequeath 160 requests are queued up and serviced in chronological order. 

The reverse of Bequeath 160 is the Inherit 170 operation, which also accepts a 
hibernaculum and a thread reference as input. The flow-chart for this operation is 
shown in Fig.7. This operation starts up an inherit-thread in the process 230. The 
inherit-thread freezes the referenced thread in the process 230 together with the 
bequeath-threads and any inherit-thread for the referenced thread, adds the program 
modules and data in the hibernaculum to the program modules and data of the process 
230, respectively, and updates its symbol table accordingly. In case of a name conflict, 
the program module or data from the hibernaculum is discarded in favor of the one 
from the process 230 by default. However, a flag can be supplied to give preference 
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to the hibernaculuni. Moreover, the context frames of the threads within the 
hibernaculum are added to the execution state of the process 230, enabHng those 
threads to run within the process. Only those threads that were active just before the 
hibernaculum was created are activated initially; threads that were suspended at that 
5 time remain suspended. Each newly acquired thread begins execution at the instruction 
indicated by the program counter in the most recent frame amongst the context frames 
that belong to that thread. After all the acquired threads and threads that they in turn 
activate have terminated, the inherit- thread resumes those threads that were frozen by 
it earlier, before terminating itself. If one of the acquired threads issues an Inlierit 170 
10 request, the acquired tlireads and the current inherit-thread would in turn be suspended, 
pending the completion of the latest Inherit operation. If an acquired tlaread does a 
Bequeath 160, the inherit-thread would wait for the Bequeath request to be satisfied 
before resuming the threads that were frozen by it. 



15 Besides constructing and absorbing new processes, the process 230 can also modify 
any of its components directly by calling the Mutate 180 operation from any thread. 
Fig.8 shows the flow-chart for the Mutate operation. The operation starts up a 
controller thread in the process 230. The controller thread first freezes all other active 
threads in the process 230, then selectively retains or discards its execution state, 

20 program modules and data. A list of context frames, together with a Hag, can be passed 
to the Mutate 180 operation to retain or discard the frames in the list. Similarly, a 
program module list and/or a data list can be provided to indicate program modules 
and data of the process 230 that should be retained or discarded. The generation of the 
execution state, program module and data lists are the same as for the Construct 1 10 
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operation. After mutation, the controller tliread resumes the threads that were frozen 
by it before terminating itself. Threads that no longer have a context frame in the 
process 230 are terminated. Each of the remaining threads resumes execution at the 
instruction indicated by the program counter in the most recent trame amongst the 
retained frames belonging to that thread. By discarding one or more of its most recent 
frames, a thread can be forced to return from the most recent module invocations. An 
exception is raised to alert the thread that those modules are not completed normally. 
Similarly, by discarding one or more of its oldest frames, a thread can be forced to 
terminate directly after completing the frames that are retained. Space freed up from 
the discarded context frames, program modules and data is automatically reclaimed by 
a garbage collector. 

The process 230 is also capable of suspending and migrating itself. The Checkpoint 
190 operation starts up a controller thread in the process 230. Fig.9 is a flow-chart 
showing the Checkpoint operation in detail. The controller thread freezes all other 
active threads in the process 230, then sends it in the form of a hibernaculum on a 
specified output stream that it established earlier. The hibernaculum contains all of the 
execution state, program modules, and data of the process 230, except for those 
belonging to the controller thread and the output stream used by the Checkpoint 190 
operation. The output stream could lead to either a disk file or the input stream of 
another process, possibly on a different machine. The controller thread ends by 
terminating the process 230. When the process in the hibernaculum is activated 
subsequently, only those threads that were active just before the Checkpoint 190 
operation will begin to execute initially; threads that were suspended at that lime will 
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remain suspended. The Checkpoint 190 operation could be invoked by one of the 
threads of the process 230, or by another process with appropriate permissions. 

The Migrate 200 operation is used to move the process 230 to another machine. Fig. 10 
5 is a flow^-chart showing the Migrate operation in detail. The operation can be invoked 
by one of the threads of the process 230, or by another process with appropriate 
permissions. The Migrate 200 operation starts up a first controller thread in the process 
230, which carries out the following steps: (a) It freezes all other active tiareads in the 
process 230. (b) It initiates a receiver process on the target machine, which runs a 

10 second controller thread, (c) The two controller ilireads establish an output stream in 
the process 230 that leads to an input stream in the receiver process, (d) Tlie second 
controller thread in the receiver process performs a Receive 130 operation on its input 
stream, (e) The first controller thread sends the process 230 in the form of a 
hibemaculum on the output stream. The hibernaculum contains all of the execution 

15 state, program modules, and data of the process 230 except for those belonging to the 
controller thread and the output stream used for the migration, (f) The first controller 
thread ends by terminating the process 230. (g) After receiving the hibemaculum, the 
second controller thread activates the process in the hibernaculum before terminating 
itself. Only those threads that were active just before the migration are activated 

20 initially; threads that were suspended at that time remain suspended. 



To implement the process migration and adaptation system of the present invention in 
a Java environment, a package called snapshot is introduced. This package contains the 
following classes, each of which defines a data structure that is used in the migration 
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and adaptation operations: 
public class Hibernaculum { 

5 } 

public class State { 

} 

10 

public class Module { 
} 

1 5 public class Data { 

} 

public class Machine { 

20 

} 
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In addition, the package contains a Snapshot class that defines the migration and 
adaptation operations: 
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public class Snapshot { 

private static native void registerNatives(); 
static { 

registerNativesQ; 

} 



public static native Hibernaculum Construct(State s. Module m. Data d); 

public static native int Send(Hibernaculuni h, OutputStream o); 

public static native Hibernaculum Receive(InputStream i); 

public static native int Assimilate(Hibernaculum h, int f); 

public static native int Usurp(Hibemaculum h, int f); 

public static native int Bequeath(Hibemaculum int 0; 

public static native int Inherit(Hibemaculuni h, int f); 

public static native int Mutate(State s. Module ni, int mflag. Data d, int dflag); 
public static native int Checkpoint(OutputStream o); 
public static native int Migrate(Machine m); 



// This class is not to be instantiated 
private Snapshot() { 

) 



The methods in the Snapshot class can be invoked from application code. For 
example: 
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try { 



if (snapshot,Snapshot.Construct(s, m, d) != null) { 



// hibernaculuni has been created 



) else { 



// failed to create hibernaculum 



catch(snapShot.SnapshotException e) { 



// Failed to create hibernaculum 



The migration and adaptation operations are implemented as native codes that 
are added to the Java virtual machine itself, using the Java Native Interface (JNI). To 
do that, a Java-to-native table is first defined: 

#define KSH Ljava/snapshot/Hibernaculum; 
#define KSS Ljava/snapshot/State; 
#define KSM Ljava/snapshot/Module; 
#define KSD Ljava/snapshot/Data; 

static JNINativeMethod snapshot_Snapshot_nati\'e_methods[] = { 



Construct , 



( KSSKSMKSD ) KSH, 



(void*)Impl_Snapshot_Consiruct 
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) y 

{ 

Send , 

( KSH Ljava/io/OutputStream;)I , 
(\oid*)Impl_Snapshot_Send 

}, 
{ 

Receive , 

(Ljava/io/InputStream;) KSH, 
(void*)Impl_Snapshot_Receive 

}, 
{ 

Assimilate , 
( KSH 1)1 , 

(void * )Imp]_Snapshot_Assimilate 

}. 
{ 

Usurp , 
( KSH 1)1 , 

(void*)]mpI_Snapshot_Usurp 

}, 
{ 
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Bequeath , 
( KSH 1)1 , 
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{ 

10 

{ 

15 

}. 
{ 

20 
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(void*)Impl_Snapshot_Bequeath 



Inherit , 
( KSH 1)1 , 

(void*)Impl_Snapshot_Ii-iherit 



Mutate , 

( KSSKSM I KSD 1)1 , 
(void*)Impl_Snapshot_Mutate 



Checkpoint , 

(Ljava/io/OutputStream;)I , 
(void*)Impl_Snapshot_Checkpoint 



Migrate , 

(Ljava/snapshot/Machine;)I , 
(void*)Impl_Snapshot_Migrate 



}; 
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After that, the native implementations are registered via the following function: 
JNIEXPORT void JNICALL 

Java_snapshot_Snapshot_registerNatives(JNIEnv *env, jclass els) { 
(*env)->RegisterNatives( env, 

els, 

snapshot_Snapshot_native_methods, 
sizeof(snapshot_Snapshot_native_methods) / 
sizeof(JNINativeMethod) ); 

} 

Besides the above native codes, several functions are added to the Java virtual 
machine implementation, each of which realizes one of the migration and adaptation 
operations: 

void* Impl_Snapshot_Construct(..) { 
// follow flowchart in Figure 3 

} 

void* Impl_Snapshot_Send(..) { 

// send given hibernaculum to specified target 

} 
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void* Impl_Snapshot_Receive(..) { 

// receive a hibernaculum from a specified source 

} 

void* ImpI_Snapshot_Assimilate(..) { 
// follow flowchart in Figure 4 

} 

void* Impl_Snapshot_Usurp(..) { 

// follow flowchart in Figure 5 

} 

void* Impl_Snapshot_Bequeath(..) { 
// follow flowchart in Figure 6 

} 

void* ImpI_Snapshot_Inherit(..) { 

// follow flowchart in Figure 7 

} 
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void* Impl_Snapshot__Mutate(..) { 

// follow flowchart in Figure 8 

} 

void* Impl_Snapshot_Checkpoint(..) { 
// follow flowchart in Figure 9 

} 

void* Impl_Snapshot_Migrate(..) { 

// follow flowchart in Figure 10 

} 

As will be apparent from the above, using the computer environment described, it is 
possible using the Construct 110 operation to create a hibernaculum of a process in 
which the data, program modules and execution state at a particular execution point 
when running on a first machine are suspended and stored. That process can then be 
transferred as an output stream to another location using the Send 120 operation, for 
example a disk file or can be transmitted to a second machine, for example at a remote 
location, for execution to be resumed either as a self-standing process or as input to 
another process rumiing on the second machine using any one of the Assimilate 140, 
Usurp 150, Bequeath 160 or Inherit 170 operations,. 
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This feature allows a customized version of software and other digital material to be 
provided by running the software to a particular execution point, prior to which 
customized features are incorporated, generating the suspended process, which 
incorporates the customization, using Construct 110 or Checkpoint 190 and then 
supplying the process to a customer as a bespoke product for the customer to use. as 
will now be explained. 

Essentially, software is v^itten to run in two phases, a customization phase and an 
execution phase. 

Customization Phase: In the customization phase, the software initializes, loads 

the program modules into memory and then takes in a configuration specification, 
either through user input or from a configuration file. The specification can include 
use control information, watermarks, user's machine identification, a user's 
cryptographic token, licence number, software features to enable/disable features, 
functions or commands (for example to permit saving of data into files, to allow the 
software to run only a limited number of times or to run only on a specific machine) 
and content to be supplied (eg an abridged or expanded version of the software). The 
software determines from the specification which data files and any further program 
modules that might be needed for the configuration are required and loads these into 
memory. Similarly, any program modules and data not required can be discarded 
using the Mutate 180 operation. A hibernaculum is then generated of the process at 
that execution point. The hibernaculum will be a binary code representation of the 
process which contains program code, data and execution state. It is preferred that 
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configuration information is stored as execution state (e.g. as stack values or in 
registers) to make it more difficult for potential hacker to access such information. 
These elements can be interleaved or encrypted by any conventional means. 

Execution Phase: The customer is provided with a utility which is capable of 
resuming execution of the process. Once the representation has been transferred to the 
customer, this is loaded into memory, the interleaving and/or encryption is reversed 
using the utility and the process resumed allowing the software to run. In order to 
prevent potential compromise of the digital goods, a series of representations may be 
sent to the customer. The earlier representation can take on the role of reversing the 
encryption and interleaving of subsequent representations, thus complicating the task 
of an attacker in accessing the digital goods. 

It will be appreciated that the software as received by the customer is not the same as 
the software prior to the customization step, since it has been modified by the 
configuration input and may thus be made unique to that customer. The software 
resumes execution to perform all its intended functions. In some applications, the 
software can be saved by suspending the process at a subsequent execution point (to 
save data, for example) by use of the Checkpoint function by the customer, but the 
program will then always resume from that subsequent execution point, so the 
customization phase is never re-entered, thus pre\'enting tampering with the 
configuration of the software as set by the manufacturer/distributor. 



It will further be appreciated that since the representation as passed to the customer as 
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a single binary file, embedded data is protected and cannot be easily accessed from 
outside the customization process. 

A first specific embodiment of protecting videos transmitted over the Internet will now 
be explained. The embodiment is implemented using the techniques described above, 
in particular using the computing language Java and using Web technology for user 
interface. Specifically, using the snapshot package described, the Java language is 
extended in conjunction with an extended Java Virtual Machine (JVM). This extended 
JVM provides the primitive commands described above to allow the creation of a 
hibemaculum of a software process that can be transmitted over a communication 
network and subsequently be resumed in another computing environment. 

In this embodiment, two machines, server 280 and client 290, are configured as shown 
in Fig. 11. The server 280 contains a Web server 300 offering digital video files for 
sales over the Internet 305. This machine implements a typical electronic commerce 
system that allows users to browse, select and pay for the video files which are stored 
on a database 310. The server further includes an extended JVM, snapshot package 
and a Server program. The client 290 runs a standard Web browser 320, together with 
an extended JVM, snapshot package and a Client program to be used by customers 
who wish to purchase/view the video files. The server 280 and client 290 further 
include a "hibernaculum server" 330 and "hibernaculum client" 340 which are arranged 
to communicate over a secure link 350 as described below. 



The user interface is shown in Figs 12-14. 
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In order to alleviate the problem of use of any \ ideo transmitted by those other than 
the user who has paid for the video, various means may be employed. One is to assign 
or request from each user a userid and password for example using the input screen 
shown in Figure 12. Subsequently, some or all of this information is embedded in the 
video viewing software prior to the hibernaculum being created to verify subsequently 
the authenticity of the user. 

After verifying the user information, the browser will show a video-list page in which 
the user can select his or her favorite video and the number of video reviews required, 
from the screen shown in Figure 13. The latter information is used to configure the 
viewing software, prior to the hibernaculum being created, to allow replaying of the 
video for a maximum number of times specified. 

Once the user confirms the order by clicking the Order! button, the client machine 
will launch the Client program. The server then sends two hibernacula to the client, 
one being of a process for loading the other, which is a hibernaculum of the video 
viewing process. This two-stage process is used for security, the other hibernaculum 
being encrypted and the one including a decryption key for the other. The screen 
display when the second hibernaculum is being sent is shown in Figure 14. The video 
can then be played on the client machine by resuming the process of the second 
hibernaculum. 

The operation of the server and client machines to provide these functions is as 
follows: 
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1. 



After the user has accessed the sener's 



site over the World Wide Web. the 



ser\'er, under command of the Server program, runs the extended JVM and loads in a 



discarded using the Mutate 180 operation. This program then displays the screen of 
Fig. 12 to the user to prompt for userid, passu'ord and any other information, such as 
client machine serial number, for access control. 

2. The server loads the digital video (data) file selected by the user (Fig. 13) into 
the video viewing program and sets the userid and password parameters. The viewing 
program may optionally apply a video watermarking process to embed user and 
licensing information directly into the video file. 

3. The ser\'er sets the licensing parameters in the video viewing program including 
the number of video reviews allowed. 

4. The serx'er runs Construct or Checkpoint to create a first hibemaculum of the 
video viewing program process with all the parameters set and video files loaded. 
During the construction of the hibernaculum, the ser\'er may selectively discard data, 
code and execution state that are not needed for the intended use of the hibernaculum. 
Specifically, data, code and executing state can be purposely made incomplete to 
complicate the task of others intending to misuse the hibemaculum. 



video viewing program having no video file saving capability or having such capability 



5. The sen-er selects a one-time secret key and encrypts the video viewing process 
with it. 
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6. The server embeds ihe same secret key into a hibernaculum loading process. 
This process may be created on demand or preloaded. The purpose for introducing the 
hibemaculum loading process is to make it more difficult to obtain access to the video 
through a possibly compromised JVM on the client machine. 

5 

7. The server then creates a hibernaculum out of the hibernaculum loading process 
and sends it to the Client using either the Migrate operations or a combination of 
Construct and Send operations, preceded by a command to the client machine 
instructing the user's browser to launch the Client program. The client program is a 

10 simple routine v^'hich runs on the JVM of the client machine and uses the snapshot 
package to first Receive and then Assimilate an incoming hibernaculum. 

8. Upon receiving the hibemaculum, the Client resumes the hibernaculum loading 
process with the Assimilate operation. 

15 

9. The hibemaculum loading process on the client machine makes a connection 
to the server machine and establishes a secure connection (e.g. using SSL) to protect 
the privacy and integrity of the network channel. 

20 10. The server sends over the encrypted video viewing hibernaculum (Fig. 14). The 
hibemaculum loading process decrypts the video viewing hibernaculum and resumes 
the process. 

1 1 . The video viewing process prompts the user for password authentication. After 
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proper authentication, the user can proceed to play the video file. 

12. After the maximum number of reviews allowed, the video viewing process 
stops the viewing capabihty and terminates itself automatically or awaits further 
instruction from the user. 

In another specific embodiment of the invention, the first specific embodiment 
described above is used for providing audio on-line. The second specific embodiment 
is practically the same as the first except that the files selectable by the user are audio 
files rather than video files, and instead of a video viewing program, an audio playing 
program is used. 

Preferably, the hibernaculum loading process is made vendor-specific by being 
independently written and by the inclusion of registration and other information. The 
essential requirements of the program must be maintained, namely that the program 
must be able to decrypt the video viewing hibernaculum and resume the process but 
it is preferable for the vendor's hibernaculum loading process to only be able to load 
hibemacula from that vendor. Similarly, to prevent simple access to the video via the 
system routines for video image display, the video viewing process can use vendor- 
specific video playing routine to make such video capturing difficult. 

In the specific described embodiment, two hibernacula are generated, one of which is 
arranged to resume running of the other. However, any number of hibernacula may 
be linked in this way. 
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The embodiments described above may also be easily adapted to protect other digital 
material provided over open networks and can be combined with each other, so that 
a single server can transfer video, audio or programs, for example, depending upon 
user selection. 

The embodiments of the invention described are not be construed as limitative, the 
scope of the invention being defined by the scope of the appendant claims. 
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CLAIMS 



ram 



1. A representation of digital material, the digital material comprising prog 
code and data and the representation comprising a combination of the code, data and 
an execution state existing at a predetermined execution point when the program code 
is run, customization information being provided during running of the program code 
prior to the execution point being reached so that said representation is customized by 
said customization information. 



2. A representation as claimed in Claim 1 wherein the information comprises 
information for the purpose of use control. 

3. A representation as claimed in Claim 1 or Claim 2 wherein the customization 
information includes information relating to at least one of: 

information identifying the material 

information identifying an intended user of the material; 

information identifying an intended machine on which the material is 

subsequently to be run; 

information specifying the number of times the digital material may be run; 
information configuring the digital material. 

4. A representation as claimed in Claim 2 wherein the information identifying the 
material includes a watermark. 
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5. A representation as claimed in Claim 3 or Claim 4 wherein the information 
identifying an intended user of the material includes user auihentificaiion information. 

6. A representation as claimed in Claim 5 wherein the authentiflcation information 
5 includes a cryptographic token. 

7. A representation as claimed in any one of Claims 3 to 6 wherein the 
information identifying an intended machine on which the material is subsequently to 
be run comprises a serial number of the machine. 

10 

8. A representation as claimed in any one of Claims 3 to 7 wherein the 
information configuring the digital material comprises information specifying program 
code and/or data and/or execution state to be selected or discarded prior to the 
execution point. 

15 

9. A representation as claimed in any one of the preceding Claims wherein said 
digital material includes video data. 

10. A representation as claimed in Claim 9 wherein the digital material includes a 
20 program to play the video data. 

11. A representation as claimed in Claim 9 or Claim 10 wherein the data included 
in the representation comprises at least one video recording specified by said 
customization information. 
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12. A representation as claimed in any one of Claims 1 to 8 wherein said digital 
material includes audio data. 

13. A representation as claimed in Claim 12 wherein the digital material includes 
5 a program to play the audio data. 

14. A representation as claimed in Claim 12 or Claim 13 wherein the data included 
in the representation comprises at least one audio recording specified by said 
customization information. 



15. A representation as claimed in any one of the preceding claims wherein the 
representation is encrypted. 

16. In combination, a representation as claimed in any one of the preceding claims 
15 and software arranged to use the representation as input for resuming the running of 

the program code from the execution point. 

17. In combination, a representation of software arranged to use the representation 
of Claim 15, as input for resuming the running of the program code from the execution 

20 point, the representation of software comprising program code, data and an execution 
state existing at a chosen execution point in running of the software, decryption 
information for decrypting the representation of Claim 15 being provided during 
running of the software prior to the chosen execution point being reached. 



10 
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18. In combination, a plurality of representations as claimed in any one of claims 
1 to 15, each representation but one being arranged to resume running of another of 
the representations. 

19. A method of processing digital material, the material comprising program code 
and data, the method comprising the steps of: 

(1) running the program code until a predetermined execution point is reached, an 
execution state existing at the execution point;and 

(2) forming a combined representation of the execution state, data and program code 
at that execution point, the data, code and execution state being restorable from said 
representation so that execution of the material may subsequently be resumed from the 
execution point. 

20. A method as claimed in Claim 19 wherein, prior to the execution point, 
customization information is provided whereby the representation is customized by the 
information. 

21. A method as claimed in Claim 20 wherein the information comprises 
information for the purpose of use control. 

22. A method as claimed in Claim 20 or Claim 21 wherein the customization 
information includes information relating to at least one of: 

information identifying the material 

information identifying an intended user of the material; 
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information identifying an intended machine on which the material is 



subsequently to be run; 



information specifying the number of times the digital material may be run; 



information configuring the digital material. 



5 

23. A method as claimed in Claim 22 wherein the information identifying the 
material includes a watermark. 

24. A method as claimed in Claim 22 or Claim 23 wherein the information 
10 identifying an intended user of the material includes user authentification information. 

25. A method as claimed in Claim 24 wherein the authentification information 
includes a cr>'ptographic token. 

15 26. A method as claimed in any one of claims 22 to 25 wherein the information 
identifying an intended machine on which the material is subsequently to be run 
comprises a serial number of the machine. 

27. A method as claimed in any one of Claims 22 to 26 wherein the information 
20 configuring the digital material comprises information specifying program code and/or 
data and/or execution state to be selected or discarded prior to the representation being 
formed. 



28. A method as claimed in any one of Claims 20 to 27 further comprising the step 
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of encr>'pting the representation. 

29. A niethod as claimed in any one of Claims 20 to 28 further comprising the step 
of storing the representation. 

30. A method as claimed in any one of Claims 20 to 29 further comprising the step 
of transferring the representation to a remote computing device. 

31. A method as claimed in any one of Claims 20 to 30 further comprising the 
steps of restoring the data, code and execution state from said representation and 
resuming execution of the program code from the execution point. 

32. A method as claimed in Claim 31 where dependent on Claim 28 further 
comprising the step of decrypting the encrypted representation prior to the restoring 
step. 

33. A method as claimed in any one of Claims 20 to 32 further comprising the 
steps of generating a plurality of representations, each representation but one being 
arranged to resume execution of the program code from the execution point of another 
of the representations. 
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